class RuboCop::Cop::Doctolib::NoAsymmetricalPunditAfterActions
Prevent uses of the `verify_authorized` and `verify_policy_scoped` after-action filters from Pundit, which potentially let some actions covered by neither after-action filter.
@example
# bad after_action :verify_policy_scoped, only: :show after_action :verify_authorized, only: :index # bad after_action :verify_policy_scoped, only: :show after_action :verify_authorized, except: :index # good after_action :verify_policy_scoped, only: :show after_action :verify_authorized, except: :show # good after_action :verify_policy_scoped, only: :show after_action :verify_authorized
Constants
- MSG
Public Instance Methods
on_class(node)
click to toggle source
# File lib/rubocop/cop/doctolib/no_asymmetrical_pundit_after_actions.rb, line 83 def on_class(node) verified_class?(node) do |policy_scoped, authorized| policy_scoped = Verify.new policy_scoped authorized = Verify.new authorized return if policy_scoped.covers_all? return if authorized.covers_all? return if only_superset_of_except? policy_scoped, authorized return if disjoint_excepts? policy_scoped, authorized add_offense policy_scoped.node add_offense authorized.node end end
Private Instance Methods
disjoint_excepts?(policy_scoped, authorized)
click to toggle source
# File lib/rubocop/cop/doctolib/no_asymmetrical_pundit_after_actions.rb, line 105 def disjoint_excepts?(policy_scoped, authorized) policy_scoped.mode == :except && authorized.mode == :except && policy_scoped.actions.disjoint?(authorized.actions) end
only_superset_of_except?(policy_scoped, authorized)
click to toggle source
# File lib/rubocop/cop/doctolib/no_asymmetrical_pundit_after_actions.rb, line 98 def only_superset_of_except?(policy_scoped, authorized) if policy_scoped.mode != authorized.mode only, except = policy_scoped.mode == :only ? [policy_scoped, authorized] : [authorized, policy_scoped] return true if only.actions >= except.actions end end